Truecrypt lost partition

Discussion in 'encryption problems' started by markosplash, Sep 29, 2013.

Thread Status:
Not open for further replies.
  1. markosplash

    markosplash Registered Member

    Joined:
    Sep 29, 2013
    Posts:
    3
    I have a quite difficult issue - an old external disk with 2 partitions, one non-encrypted NTFS, other encrypted NTFS with truecrpyt.

    The issue happened due to the following actions:

    1. I forgot the partition was encrypted, so I tried to recover it with testdisk, I accidently wrote wrong partition layout down, which resulted in lost encrypted partition record in the partition table. The partition shown as unallocated space since then.

    2. I went into windows computer management -> disk management and assigned the partition as new simple volume with a drive letter - without formatting it.

    3. I was now able to mount the partition in Truecrypt with backup truecrypt header and pre-boot authentication, it correctly listed it as AES and the size was correct, but when I try to access the files I get the message: P:\ is not accessible, parameter is incorrect.

    4. I tried to list the files with some data recovery tool, if the decryption works and it does! It listed various jpeg files, pdfs... But the names of the files were often incorrect and the file tree structure was wrong with random folders, etc.

    It seems to me that the action at point 2 overwritten some section important to partition table and this is now causing problems. How could I recover this partition now?

    If I try to list the partitions with testdisk on the MOUNTED drive P, I get many partitions - Invalid NTFS or EXFAT boot 0 D - HPFS - NTFS or something along this line.

    Oh, and I don't have backup of the header, neither the truecrypt recovery disk :(

    Any help would be greatly appreciated...
     
  2. markosplash

    markosplash Registered Member

    Joined:
    Sep 29, 2013
    Posts:
    3
    Also, test disk says that the partition sector (when drive is mounted with TC) has no endmark 0xAA55
     
  3. markosplash

    markosplash Registered Member

    Joined:
    Sep 29, 2013
    Posts:
    3
    I'm still lost. Any advice? I manage to get filenames and folder structure with raw recovery software, some of the files even seem ok (pictures), but when I try to copy the most important file on the disk - truecrypt rescue disk, it's unfortunately corrupted...
     
  4. dantz

    dantz Registered Member

    Joined:
    Jan 19, 2007
    Posts:
    991
    Location:
    Hawaii
    Please clarify. Did the encrypted partition contain an encrypted, bootable operating system? Was a TrueCrypt bootloader installed? Or was this merely a data partition? I ask because the TC recovery disk cannot be used to mount a data partition. It's strictly for an encrypted OS. Preboot authentication also applies only to encrypted OS's.
     
Loading...
Thread Status:
Not open for further replies.